What it is
XXE is the bug that won't die. XML standards predate the modern internet's threat model, and that lineage shows in the defaults: most XML parsers across most languages happily resolve external entities unless you explicitly tell them not to. Modern app developers don't write XML, but their dependencies do — SAML SSO flows, SOAP integrations, SVG image processing, OOXML and ODF document parsers, RSS importers, and a long tail of legacy enterprise integrations. The bug returns each time someone wires a parser into a new code path without remembering to disable DOCTYPE processing. The fix is one config line. The exploitation is one curl command.
How it happens
XXE issues appear when XML parsers accept untrusted external entity behavior. Depending on parser configuration, this can expose internal files, metadata services, or internal network endpoints.
What an attacker gets
Local file read at the privilege of the web server process — application config, secrets files, source code, /etc/passwd, environment variables. SSRF into the cloud metadata service hands over IAM credentials. DoS via billion-laughs trivially knocks the parser process over. On parsers that support PHP filter wrappers or expect://, the bug grades up to remote code execution. SAML and SOAP integrations are particularly painful because the XXE vector lives in the trusted authentication path.
// what fixvibe reports
What FixVibe reports
Runs in active scans of a domain you have verified you own, on Hobby and above. Each finding shows the affected URL or host, its severity and fix steps you can paste into your AI coding tool.
How to fix it
Disable external entity resolution at the parser level. Every major XML parser has the flag: in Java, `factory.setFeature('http://apache.org/xml/features/disallow-doctype-decl', true)`; in libxml-based parsers, `XML_PARSE_NOENT` set to false plus `XML_PARSE_NONET`; in Python's lxml, use `defusedxml` instead of the stdlib parser; in .NET, `XmlReaderSettings { DtdProcessing = DtdProcessing.Prohibit }`. Better still, use JSON wherever you have the choice — most modern apps don't actually need XML, they inherited it from a legacy integration. For SAML and SOAP, use a battle-tested library that already has XXE defenses baked in (don't roll your own XML parsing for these). As a defense-in-depth layer, restrict the parser process's network egress and filesystem access — XXE that can only reach the public internet is significantly less useful to an attacker than XXE with metadata-service access.